Add full XCA curve and digest parity

README.md

@@ -57,12 +57,19 @@ OIDC_0_REDIRECT_URI=https://kca.example.com/auth/default/callback
 Every user owns a private set of vaults. A vault contains keys, certificates,
 requests, CRLs and templates; non-owners get `404`. Vaults can be renamed,
 deleted and configured from **Settings** (default hash, serial length,
-explicit/mandatory DN entries, default key type/size, default validity).
+explicit/mandatory DN entries, default key type/size/curve, default validity).
 
 ### Keys
 
-- Generate RSA (1024–8192), DSA (1024–3072), EC (P-192/P-224/P-256/P-384/P-521,
-  secp256k1, brainpool) and Ed25519 keys.
+- Generate RSA (1024–8192), DSA (1024–3072), Ed25519 and EC keys across the
+  complete set of 79 named curves exposed by XCA (NIST/SECG, X9.62, binary,
+  WTLS and Brainpool variants). Legacy curves use an in-memory OpenSSL 3
+  compatibility backend; existing native curves continue through `cryptography`.
+- Sign certificates, requests and CRLs with XCA's key-specific hash matrix:
+  RSA supports MD5, RIPEMD-160, SHA-1, SHA-2 and SHA-3; EC supports SHA-1,
+  SHA-2 and SHA-3; DSA supports SHA-1/SHA-224/SHA-256; Ed25519 uses its
+  built-in signature algorithm. Insecure compatibility choices are marked in
+  the UI and SHA-256 remains the default.
 - Import PEM/DER public or private keys, PKCS#8, OpenSSH, PKCS#12 and PVK.
 - Export PEM public/private, traditional encrypted PEM, PKCS#8 (plain or
   encrypted), DER public/private, SSH2 public/private, JWK public/private and